Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Use TypeScript for RoleCommand and RolesCommand #4791

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
greenbonebot merged 1 commit into from
Aug 22, 2025
Merged

Use TypeScript for RoleCommand and RolesCommand #4791

greenbonebot merged 1 commit into from
Aug 22, 2025

Conversation

@bjoernricks
Copy link
Contributor

@bjoernricks bjoernricks commented Aug 22, 2025

What

Use TypeScript for RoleCommand and RolesCommand

Also add tests for both commands.

Why

Allow to validate all role specific http requests and responses.

References

https://jira.greenbone.net/browse/GEA-1098

Checklist

  • Tests

@bjoernricks bjoernricks requested a review from a team as a code owner August 22, 2025 08:52
@greenbonebot greenbonebot enabled auto-merge (rebase) August 22, 2025 08:52
@github-actions
Copy link

github-actions bot commented Aug 22, 2025 •
edited
Loading

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

@bjoernricks bjoernricks force-pushed the typescript-role-commands branch from b488348 to 69d099e Compare August 22, 2025 08:52
@github-actions
Copy link

github-actions bot commented Aug 22, 2025 •
edited
Loading

🔍 Vulnerabilities of harbor-os.greenbone.net/community/gsa:4791-merge-amd64

📦 Image Reference harbor-os.greenbone.net/community/gsa:4791-merge-amd64
digestsha256:dfbe06df787ccca07537320a2019e62446ab3c9809f1b282011a25ab07802626
vulnerabilitiescritical: 1 high: 4 medium: 6 low: 38
size74 MB
packages215
📦 Base Image debian:stable-20250721-slim
also known as
  • stable-slim
digestsha256:3249eafa46d713ba80c92f750b222ba4bfb8a7a71f52ad9925cedbc2f11aa208
vulnerabilitiescritical: 0 high: 1 medium: 1 low: 24
critical: 1 high: 0 medium: 0 low: 0 zlib 1:1.2.13.dfsg-1 (deb)

pkg:deb/debian/zlib@1:1.2.13.dfsg-1?os_distro=trixie&os_name=debian&os_version=13

critical : CVE--2023--45853

Affected range<1:1.3.dfsg-2
Fixed version1:1.3.dfsg-2
EPSS Score0.51%
EPSS Percentile65th percentile
Description

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.

critical: 0 high: 2 medium: 1 low: 2 perl 5.36.0-7+deb12u2 (deb)

pkg:deb/debian/[email protected]%2Bdeb12u2?os_distro=trixie&os_name=debian&os_version=13

high : CVE--2023--31484

Affected range<5.38.2-2
Fixed version5.38.2-2
EPSS Score0.91%
EPSS Percentile75th percentile
Description

CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.

[experimental] - perl 5.38.0~rc2-1

high : CVE--2023--47038

Affected range<5.36.0-10
Fixed version5.36.0-10
EPSS Score0.15%
EPSS Percentile36th percentile
Description

A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.

medium : CVE--2025--40909

Affected range<5.40.1-5
Fixed version5.40.1-5
EPSS Score0.01%
EPSS Percentile0th percentile
Description

Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6

[experimental] - perl 5.40.1-4

low : CVE--2024--56406

Affected range<5.40.1-3
Fixed version5.40.1-3
EPSS Score0.06%
EPSS Percentile18th percentile
Description

A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes in the left-hand-side of the tr operator, S_do_trans_invmap can overflow the destination pointer d.    $ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;'    Segmentation fault (core dumped) It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.

low : CVE--2023--31486

Affected range<5.38.2-2
Fixed version5.38.2-2
EPSS Score0.45%
EPSS Percentile63rd percentile
Description

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.

critical: 0 high: 1 medium: 2 low: 1 pam 1.5.2-6+deb12u1 (deb)

pkg:deb/debian/[email protected]%2Bdeb12u1?os_distro=trixie&os_name=debian&os_version=13

high : CVE--2025--6020

Affected range<1.7.0-5
Fixed version1.7.0-5
EPSS Score0.02%
EPSS Percentile4th percentile
Description

A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.

[experimental] - pam 1.7.0-4

medium : CVE--2024--22365

Affected range<1.5.3-4
Fixed version1.5.3-4
EPSS Score0.08%
EPSS Percentile24th percentile
Description

linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.

[experimental] - pam 1.5.3-2

medium : CVE--2024--10041

Affected range<1.7.0-2
Fixed version1.7.0-2
EPSS Score0.03%
EPSS Percentile7th percentile
Description

A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.

[experimental] - pam 1.7.0-1

low : CVE--2024--10963

Affected range<1.7.0-5
Fixed version1.7.0-5
EPSS Score0.22%
EPSS Percentile44th percentile
Description

A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals.

critical: 0 high: 1 medium: 0 low: 0 dpkg 1.21.22 (deb)

pkg:deb/debian/[email protected]?os_distro=trixie&os_name=debian&os_version=13

high : CVE--2025--6297

Affected range<1.22.21
Fixed version1.22.21
EPSS Score0.08%
EPSS Percentile25th percentile
Description

It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and repeated execution of dpkg-deb commands on adversarial .deb packages or with well compressible files, placed inside a directory with permissions not allowing removal by a non-root user, this can end up in a DoS scenario due to causing disk quota exhaustion or disk full conditions.

critical: 0 high: 0 medium: 1 low: 1 tar 1.34+dfsg-1.2+deb12u1 (deb)

pkg:deb/debian/[email protected]%2Bdfsg-1.2%2Bdeb12u1?os_distro=trixie&os_name=debian&os_version=13

medium : CVE--2023--39804

Affected range<1.34+dfsg-1.3
Fixed version1.34+dfsg-1.3
EPSS Score0.04%
EPSS Percentile10th percentile
Description

In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.

low : CVE--2022--48303

Affected range<1.34+dfsg-1.4
Fixed version1.34+dfsg-1.4
EPSS Score0.03%
EPSS Percentile7th percentile
Description

GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.

critical: 0 high: 0 medium: 1 low: 0 libcap2 1:2.66-4+deb12u1 (deb)

pkg:deb/debian/libcap2@1:2.66-4%2Bdeb12u1?os_distro=trixie&os_name=debian&os_version=13

medium : CVE--2025--1390

Affected range<1:2.73-4
Fixed version1:2.73-4
EPSS Score0.03%
EPSS Percentile6th percentile
Description

The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames.

critical: 0 high: 0 medium: 1 low: 0 libtasn1-6 4.19.0-2+deb12u1 (deb)

pkg:deb/debian/[email protected]%2Bdeb12u1?os_distro=trixie&os_name=debian&os_version=13

medium : CVE--2024--12133

Affected range<4.20.0-1
Fixed version4.20.0-1
EPSS Score0.32%
EPSS Percentile55th percentile
Description

A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate, causing a denial of service attack.

critical: 0 high: 0 medium: 0 low: 7 glibc 2.41-12 (deb)

pkg:deb/debian/[email protected]?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2019--9192

Affected range>=2.41-12
Fixed versionNot Fixed
EPSS Score0.16%
EPSS Percentile38th percentile
Description

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\1\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern

low : CVE--2019--1010025

Affected range>=2.41-12
Fixed versionNot Fixed
EPSS Score0.23%
EPSS Percentile46th percentile
Description

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability.

low : CVE--2019--1010024

Affected range>=2.41-12
Fixed versionNot Fixed
EPSS Score0.38%
EPSS Percentile58th percentile
Description

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.

low : CVE--2019--1010023

Affected range>=2.41-12
Fixed versionNot Fixed
EPSS Score0.70%
EPSS Percentile71st percentile
Description

GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.

low : CVE--2019--1010022

Affected range>=2.41-12
Fixed versionNot Fixed
EPSS Score0.14%
EPSS Percentile35th percentile
Description

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.

low : CVE--2018--20796

Affected range>=2.41-12
Fixed versionNot Fixed
EPSS Score2.05%
EPSS Percentile83rd percentile
Description

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\1\1|t1|\\2537)+' in grep.

low : CVE--2010--4756

Affected range>=2.41-12
Fixed versionNot Fixed
EPSS Score0.37%
EPSS Percentile58th percentile
Description

The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.

  • glibc (unimportant)
  • eglibc (unimportant)
    That's standard POSIX behaviour implemented by (e)glibc. Applications using
    glob need to impose limits for themselves
critical: 0 high: 0 medium: 0 low: 4 systemd 257.7-1 (deb)

pkg:deb/debian/[email protected]?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2023--31439

Affected range>=257.7-1
Fixed versionNot Fixed
EPSS Score0.09%
EPSS Percentile27th percentile
Description

An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

low : CVE--2023--31438

Affected range>=257.7-1
Fixed versionNot Fixed
EPSS Score0.10%
EPSS Percentile28th percentile
Description

An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

low : CVE--2023--31437

Affected range>=257.7-1
Fixed versionNot Fixed
EPSS Score0.13%
EPSS Percentile33rd percentile
Description

An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."

low : CVE--2013--4392

Affected range>=257.7-1
Fixed versionNot Fixed
EPSS Score0.07%
EPSS Percentile21st percentile
Description

systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.

critical: 0 high: 0 medium: 0 low: 4 openldap 2.6.10+dfsg-1 (deb)

pkg:deb/debian/[email protected]%2Bdfsg-1?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2020--15719

Affected range>=2.6.10+dfsg-1
Fixed versionNot Fixed
EPSS Score0.37%
EPSS Percentile58th percentile
Description

libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.

low : CVE--2017--17740

Affected range>=2.6.10+dfsg-1
Fixed versionNot Fixed
EPSS Score2.84%
EPSS Percentile86th percentile
Description

contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.

low : CVE--2017--14159

Affected range>=2.6.10+dfsg-1
Fixed versionNot Fixed
EPSS Score0.11%
EPSS Percentile31st percentile
Description

slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill cat /pathname" command, as demonstrated by openldap-initscript.

low : CVE--2015--3276

Affected range>=2.6.10+dfsg-1
Fixed versionNot Fixed
EPSS Score1.76%
EPSS Percentile82nd percentile
Description

The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.

  • openldap (unimportant)
    Debian builds with GNUTLS, not NSS
critical: 0 high: 0 medium: 0 low: 3 krb5 1.21.3-5 (deb)

pkg:deb/debian/[email protected]?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2024--26461

Affected range>=1.21.3-5
Fixed versionNot Fixed
EPSS Score0.08%
EPSS Percentile25th percentile
Description

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.

low : CVE--2024--26458

Affected range>=1.21.3-5
Fixed versionNot Fixed
EPSS Score0.21%
EPSS Percentile43rd percentile
Description

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.

low : CVE--2018--5709

Affected range>=1.21.3-5
Fixed versionNot Fixed
EPSS Score0.48%
EPSS Percentile64th percentile
Description

An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.

critical: 0 high: 0 medium: 0 low: 2 libgcrypt20 1.11.0-7 (deb)

pkg:deb/debian/[email protected]?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2024--2236

Affected range>=1.11.0-7
Fixed versionNot Fixed
EPSS Score0.27%
EPSS Percentile50th percentile
Description

A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

low : CVE--2018--6829

Affected range>=1.11.0-7
Fixed versionNot Fixed
EPSS Score1.27%
EPSS Percentile79th percentile
Description

cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.

critical: 0 high: 0 medium: 0 low: 2 xz-utils 5.4.1-1 (deb)

pkg:deb/debian/[email protected]?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2025--31115

Affected range<5.8.1-1
Fixed version5.8.1-1
EPSS Score0.12%
EPSS Percentile32nd percentile
Description

XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null pointer plus an offset. Applications and libraries that use the lzma_stream_decoder_mt function are affected. The bug has been fixed in XZ Utils 5.8.1, and the fix has been committed to the v5.4, v5.6, v5.8, and master branches in the xz Git repository. No new release packages will be made from the old stable branches, but a standalone patch is available that applies to all affected releases.

low : CVE--2024--3094

Affected range<5.6.1+really5.4.5-1
Fixed version5.6.1+really5.4.5-1
EPSS Score86.57%
EPSS Percentile99th percentile
Description

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0.
Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

critical: 0 high: 0 medium: 0 low: 2 coreutils 9.1-1 (deb)

pkg:deb/debian/[email protected]?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2024--0684

Affected range<9.5-1
Fixed version9.5-1
EPSS Score0.07%
EPSS Percentile22nd percentile
Description

A flaw was found in the GNU coreutils "split" program. A heap overflow with user-controlled data of multiple hundred bytes in length could occur in the line_bytes_split() function, potentially leading to an application crash and denial of service.

low : CVE--2016--2781

Affected range<9.4-1
Fixed version9.4-1
EPSS Score0.06%
EPSS Percentile20th percentile
Description

chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

  • coreutils 9.4-1 (low; bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=816320)
    [bookworm] - coreutils (Minor issue)
    [bullseye] - coreutils (Minor issue)
    [buster] - coreutils (Minor issue)
    [stretch] - coreutils (Minor issue)
    [jessie] - coreutils (Minor issue)
    [wheezy] - coreutils (Minor issue)
    Restricting ioctl on the kernel side seems the better approach, but rejected by Linux upstream
    Fixing this issue via setsid() would introduce regressions:
    https://www.kernel.org/pub/linux/utils/util-linux/v2.28/v2.28-ReleaseNotes
    Since Linux 6.4.4-1 (uploaded on 23 Jul 2023), TIOCSTI is disabled on the
    kernel side, marking the first coreutils upload after that date (9.4-1) as the
    fixed version
critical: 0 high: 0 medium: 0 low: 1 glib2.0 2.84.3-1 (deb)

pkg:deb/debian/[email protected]?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2012--0039

Affected range>=2.84.3-1
Fixed versionNot Fixed
EPSS Score0.49%
EPSS Percentile64th percentile
Description

GLib 2.31.8 and earlier, when the g_str_hash function is used, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this issue may be disputed by the vendor; the existence of the g_str_hash function is not a vulnerability in the library, because callers of g_hash_table_new and g_hash_table_new_full can specify an arbitrary hash function that is appropriate for the application.

critical: 0 high: 0 medium: 0 low: 1 sqlite3 3.46.1-7 (deb)

pkg:deb/debian/[email protected]?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2021--45346

Affected range>=3.46.1-7
Fixed versionNot Fixed
EPSS Score0.21%
EPSS Percentile44th percentile
Description

A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect.

critical: 0 high: 0 medium: 0 low: 1 gcc-12 12.2.0-14+deb12u1 (deb)

pkg:deb/debian/[email protected]%2Bdeb12u1?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2023--4039

Affected range<12.3.0-9
Fixed version12.3.0-9
EPSS Score0.15%
EPSS Percentile37th percentile
Description

DISPUTEDA failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables. The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.

critical: 0 high: 0 medium: 0 low: 1 gnutls28 3.8.9-3 (deb)

pkg:deb/debian/[email protected]?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2011--3389

Affected range>=3.8.9-3
Fixed versionNot Fixed
EPSS Score4.51%
EPSS Percentile89th percentile
Description

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

critical: 0 high: 0 medium: 0 low: 1 util-linux 2.41-5 (deb)

pkg:deb/debian/[email protected]?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2022--0563

Affected range>=2.41-5
Fixed versionNot Fixed
EPSS Score0.03%
EPSS Percentile5th percentile
Description

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

critical: 0 high: 0 medium: 0 low: 1 libxml2 2.12.7+dfsg+really2.9.14-2.1 (deb)

pkg:deb/debian/[email protected]%2Bdfsg%2Breally2.9.14-2.1?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2025--8732

Affected range>=2.12.7+dfsg+really2.9.14-2.1
Fixed versionNot Fixed
EPSS Score0.01%
EPSS Percentile2nd percentile
Description

A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that "[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all."

critical: 0 high: 0 medium: 0 low: 1 hiredis 1.2.0-6 (deb)

pkg:deb/debian/[email protected]?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2025--29479

Affected range>=1.2.0-6
Fixed versionNot Fixed
EPSS Score0.01%
EPSS Percentile1st percentile
Description

Buffer Overflow in hiredis 1.2.0 allows a local attacker to cause a denial of service via the sdscatlen function.

REJECTED

critical: 0 high: 0 medium: 0 low: 1 gnupg2 2.4.7-21 (deb)

pkg:deb/debian/[email protected]?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2022--3219

Affected range>=2.4.7-21
Fixed versionNot Fixed
EPSS Score0.01%
EPSS Percentile1st percentile
Description

GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.

critical: 0 high: 0 medium: 0 low: 1 shadow 1:4.17.4-2 (deb)

pkg:deb/debian/shadow@1:4.17.4-2?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2007--5686

Affected range>=1:4.17.4-2
Fixed versionNot Fixed
EPSS Score0.33%
EPSS Percentile55th percentile
Description

initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.

  • shadow (unimportant)
    See #290803, on Debian LOG_UNKFAIL_ENAB in login.defs is set to no so
    unknown usernames are not recorded on login failures
critical: 0 high: 0 medium: 0 low: 1 openssl 3.5.1-1 (deb)

pkg:deb/debian/[email protected]?os_distro=trixie&os_name=debian&os_version=13

low : CVE--2010--0928

Affected range>=3.2.1-3
Fixed versionNot Fixed
EPSS Score0.11%
EPSS Percentile30th percentile
Description

OpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack."

http://www.eecs.umich.edu/~valeria/research/publications/DATE10RSA.pdf
openssl/openssl#24540
Fault injection based attacks are not within OpenSSLs threat model according
to the security policy: https://www.openssl.org/policies/general/security-policy.html

@codecov
Copy link

codecov bot commented Aug 22, 2025 •
edited
Loading

Codecov Report

❌ Patch coverage is 94.44444% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 69.79%. Comparing base (b618406) to head (514593b).
⚠️ Report is 1 commits behind head on main.

Files with missing lines Patch % Lines
src/web/entity/EntityPermissions.tsx 0.00% 1 Missing ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #4791      +/-   ##
==========================================
+ Coverage   69.77%   69.79%   +0.02%     
==========================================
  Files        1063     1063              
  Lines       99574    99574              
  Branches     7593     7598       +5     
==========================================
+ Hits        69476    69497      +21     
+ Misses      30077    30056      -21     
  Partials       21       21

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@bjoernricks bjoernricks force-pushed the typescript-role-commands branch from 69d099e to 514593b Compare August 22, 2025 09:28
@greenbonebot greenbonebot merged commit 440d036 into main Aug 22, 2025
17 of 28 checks passed
@greenbonebot greenbonebot deleted the typescript-role-commands branch August 22, 2025 09:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@daniele-mng daniele-mng daniele-mng approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@bjoernricks @daniele-mng @greenbonebot